Endpoint Protection

We support over a hundred users at a law firm. We are experiencing random computer crashes related to Symantec. I previously thought that the problem was localized to 64bit operating systems but have recently had a 32 bit XP computer crash. I'm fairly positive that the problem is being caused by Symantec due to the fact that the issues go away when Symantec is disabled or uninstalled. Upon reinstall, the computer works fine until a day or two later.

Let me clarify what I mean when I say "crash". All applications lock up, the computer is totally unusble and multiple errors pop up. Task Manager is unaccesable and the only way to shut down is a hard shut down holding the power button. One of the most consistant errors that I see is "LicenseManRes.dll could not be found". This particular error shows up over and over until the computer is turned off with a hard shutdown. Another error that we see is "An exception occured. Process will be terminated." Another error that we see is "The instruction at "0x00000etc" referenced memory at "0x000etc". The required data was not placed into memory because of an I/O error status "0x0000etc. Click ok to terminate the program".

The only change that we made to our Symantec system occured one month ago when we updated our version. We have had a total of 3 crashes with XP and Windows 7. I need to try to stop this before it happens to any more of our workstations Any thoughts?

What's the exact version you're currently on and what version did you upgrade from?

Also, what components are being used?

The following are installed on a standard x86 user's computer:

Symantec Endpoint Protection Version 12.1.3001.165.

> Virus and Spyware Definitions Win32 (hub)
> SONAR Definitions
> AP Portal List
> Virus and Spyware Definitions Win32
> Extended File Attributes and Signatures
> Centralized Reputation Settings
> Intrusion Prevention Signatures
> Submission Control Thresholds
> Symantec Whitelist
> Revocation Data

I'm not sure which version we upgraded from but I'm pretty sure it was the newest previous version.

Do you have the application and device control component installed and a policy applied for it?

I'm not exactly sure what you mean, could you explain where and how I might find that information?

You can check what components you have installed in SEP thru add/remove programs in the Control Panel. Just select SEP and Change. Walk thru the steps to see if that component is installed.

You should also be able to see if you have a policy assigned via the SEPM on the Policies page

By "Symantec" I'm guessing that you mean Symantec Endpoint Protection?

This forum is for the Symantec Altiris products.  I'll go ahead and move this thread to the Endpoint Protection forum where more users can help you out with your issues.

Cheers!

Okay, thanks HighTower.

Yes _Brian, the application and device control component is installed and a policy is applied.

My first recommendation would be to open a support call with Symantec. The reason being is these types of situations will require advanced troubleshooting and Symantec is best equipped to handle this.

With that being said, my first response would be to remove all components EXCEPT antivirus and work from there.

I'm on RU3 and have not experienced this, however, I don't know the setup of your machines so there could be a conflict with a piece of software or hardware and one of the components in SEP.

Ok, thanks _Brian.

Hi

Upgrade it to SEP 12.1.3

Regards

have you gotten this resolved?

Troubleshooting computer issues with the Symantec Help support tool

Do you need more assistance with your problem or were you able to get it resolved?

If you could post an update for followers of this thread that would be most helpful.

Otherwise, if resolved, you can close the thread out by clicking the "Mark as solution" link at the bottom left on the most helpful post. If multiple posts helped to solve your problem, please click the "Request split solution" link at the bottom left, select the most helpful posts and click the "Submit" button. This will benefit admins looking for a resolution to the same problem.

Thanks and take care,
Brian

My apologies for not updating this sooner.

Our issue has been resolved. Dell Optiplex 9020's were shipped with a bad operating system ISO. Uninstallation of symantec would temporarily resolve the issue, but it would re-occur due to the bad OS image.

Reinstallation of the Operating System is the only known solution for this problem.

For anyone that faces this issue in the future: constant and random werfault.exe errors that cannot be removed are due to a bad pre-installed operating system image from the manufacturer.

Much appreciated on the update!